Compliance Obligations Register
Instructions for Use
This register is ABAS's single consolidated definition of its recurring compliance obligations: what is owed, on what cadence or trigger, by which role, and where the evidence lands. Each obligation carries a stable identifier (OBL-NNN) and names its governing source.
What the register does and does not hold. The register defines obligations. Scheduling, due dates, completion records, and evidence artifacts are operational state and live in the Company's compliance management system, which ingests this register. Live state never prints here.
Scope. The register holds obligations that recur on a calendar cadence and obligations triggered by ordinary business events (hire, engagement, termination, policy revision, disclosure-triggering change). Incident-response clocks are procedures and live in their governing documents: SOP-002 for breach response, POL-003-SOP for ticket and grievance response.
How to use this register:
- Read each row's source before performing the obligation. The row is the index. The governing document carries the full requirement.
- When a policy, SOP, or authority adds, changes, or retires a recurring obligation, revise this register in the same cycle. A row is never edited in the operational system alone.
- Retired obligations keep their identifier with a Retired status. Identifiers are never reused.
- Payer revalidation and recredentialing cycles vary by payer. The row defines the obligation; each payer's confirmed cycle is recorded in the compliance management system when it is confirmed.
Obligations Register
Monthly
| ID | Obligation | Owner | Source | Evidence and location |
|---|---|---|---|---|
| OBL-001 | Re-screen all current employees and active contractors against the LEIE, SAM.gov exclusions, and state Medicaid exclusion lists | Human Resources | POL-011 | Screening records, compliance program files |
| OBL-002 | Re-screen all active vendors against the same three lists | Director of Operations | POL-011; REG-002 | REG-002 exclusion-screening record |
| OBL-003 | Verify the anonymous reporting channel end to end with a test submission | Compliance Officer | This register | Test verification record, compliance program files |
Quarterly
| ID | Obligation | Owner | Source | Evidence and location |
|---|---|---|---|---|
| OBL-004 | Hold the Compliance Committee meeting and record minutes | Committee Chair | POL-002 | CFM-001 minutes, compliance program files |
| OBL-005 | Submit the Committee's written summary to the Executive Director within 10 business days of each meeting | Committee Chair | POL-002 | Summary on file, compliance program files |
| OBL-006 | Submit the Compliance Officer's written report to the Committee and Executive Director, including training completion rates and open gaps | Compliance Officer | POL-001; TRN-001 | Report on file, compliance program files |
Annual
| ID | Obligation | Owner | Source | Evidence and location |
|---|---|---|---|---|
| OBL-007 | Run the CORI cycle: refreshed acknowledgment form and re-check for every employee | Human Resources | POL-017 | HRIS acknowledgments; iCORI records |
| OBL-008 | Review active vendor and referral-source arrangements, with Executive Director signature | Compliance Officer; Executive Director | POL-005 | REG-002 review fields |
| OBL-009 | Re-review any active physician arrangements | Compliance Officer | POL-007 | REG-002; compliance program files |
| OBL-010 | Audit credential records and a sample of personnel files; report to the Committee | Compliance Officer | POL-010; REG-001 | Audit report, compliance program files |
| OBL-011 | Develop or update the annual compliance work plan | Compliance Officer | POL-001 | Work plan, compliance program files |
| OBL-012 | Review the Compliance Officer charter | Compliance Officer | POL-001 | Revision history |
| OBL-013 | Review the Compliance Committee charter | Compliance Committee | POL-002 | Minutes; revision history |
| OBL-014 | Review the Code of Conduct | Compliance Officer | COC-001 | Revision history |
| OBL-015 | Review the gift and courtesy limit against current OIG nominal-value guidance | Compliance Officer | STD-001 | Revision history |
| OBL-016 | Review every published controlled document on its review cycle | Document owner | Document control record | Revision history per document |
| OBL-017 | Deliver compliance refresher training to all employees, plus role-specific modules | Training Coordinator; Compliance Officer | TRN-001 | Training completion record |
| OBL-018 | Re-acknowledge the Code of Conduct across the entire workforce | Compliance Officer | COC-001 | Acknowledgment records, HRIS |
| OBL-019 | Run the conflict-of-interest disclosure cycle, including no-conflicts attestations, and report the summary to the Committee | Compliance Officer; Human Resources | POL-009 | CFM-002 forms; CFM-004 log; summary report |
| OBL-020 | Distribute HR-001 with the CFM-008 acknowledgment on the fixed campaign date; confirm completeness | Human Resources; Compliance Officer | HR-001; CFM-008 | HRIS acknowledgment records; campaign report |
| OBL-021 | Re-issue the PFML workforce notice on the fall DFML rate announcement, effective January 1 | Human Resources | CFM-006 | HRIS acknowledgment capture |
| OBL-022 | Complete at least 8 hours of Compliance Officer continuing education | Compliance Officer | POL-001; PER-001 | CE certificates, personnel file |
| OBL-023 | File the calendar year's breach log with HHS within 60 days after the year ends | Privacy & Security Officer | POL-014; SOP-002 | Portal filing record; breach log |
| OBL-024 | Review the written information security program and refresh the risk analysis | Privacy & Security Officer | 201 CMR 17.00 | Risk analysis record, compliance program files |
| OBL-025 | Review the Section 1557 language-access program: enforcement climate, source-translation availability, tagline procurement posture | Compliance Officer | 45 CFR Part 92; PRV-004 | Review record, compliance program files |
| OBL-026 | Review service rates, with Clinical Director and Executive approval | Clinical Director; Executive Director | REG-003 | REG-003 revision; review record |
| OBL-027 | Renew business insurance: general liability, workers compensation, and cyber liability where held | Executive Director | Company operations | Policy declarations on file |
Scheduled by plan or payer
| ID | Obligation | Cadence | Owner | Source | Evidence and location |
|---|---|---|---|---|---|
| OBL-028 | Audit claims coding and billing against documentation | Per the annual compliance work plan | Compliance Officer | POL-013; POL-004 | Audit reports to the Committee |
| OBL-029 | Complete payer revalidation and recredentialing | Per payer schedule | Executive Director | Payer agreements | Credentialing records, payer correspondence |
Event-driven
| ID | Obligation | Trigger | Owner | Source | Evidence and location |
|---|---|---|---|---|---|
| OBL-030 | Pre-hire exclusion screening for every candidate | At hire | Human Resources | POL-011 | Screening record |
| OBL-031 | CORI acknowledgment and check after the conditional offer | At hire | Human Resources | POL-017 | HRIS acknowledgment; iCORI record |
| OBL-032 | Complete the compliance onboarding set: onboarding training, TRN-002 acknowledgment, Code acknowledgment, conflict-of-interest disclosure, HR-001 with CFM-008, PFML notice, handbook receipt | At hire | Human Resources; Training Coordinator | TRN-001; TRN-002; COC-001; POL-009; HR-001; CFM-006 | HRIS e-sign records |
| OBL-033 | Complete the vendor trio: REG-002 row, pre-engagement exclusion screening, and a business associate agreement where the vendor handles PHI | At engagement | Director of Operations; Compliance Officer | POL-005; POL-011; REG-002 | REG-002 row |
| OBL-034 | Revoke access to systems holding PHI or personal information | At termination | Privacy & Security Officer; Human Resources | 201 CMR 17.00 | Offboarding record, HRIS |
| OBL-035 | Communicate the change to affected workforce members and capture acknowledgment where required | On policy adoption or material revision | Compliance Officer; Training Coordinator | TRN-001 | Campaign and acknowledgment records |
| OBL-036 | Submit a conflict-of-interest disclosure within 10 business days | On a change in circumstances | Workforce member; Compliance Officer | POL-009 | CFM-002 form; CFM-004 log |
Realization
The register may be realized on paper, as an electronic document, or in the Company's compliance management system. Any realization carries every field defined here and references each obligation by its identifier.
Field contract. Each row defines: the identifier (OBL-NNN, stable for the life of the obligation, never reused); the obligation in one sentence; the cadence or trigger; the owning role or roles (role titles, per the Company's contact conventions); the governing source (document numbers or the legal authority); and the evidence artifact with its filing location, named by function.
Cadence and trigger vocabulary. Cadences are monthly, quarterly, annual, per the annual compliance work plan, or per payer schedule. A cadence may carry a binding window in its obligation text, such as within 60 days after the calendar year ends. Triggers are: at hire, at engagement, at termination, on policy adoption or material revision, and on a change in circumstances.
Division of labor with the compliance management system. This register defines the obligations. The compliance management system schedules them, records completions, and holds the evidence pointers. The system re-ingests the register at each approved revision, matching rows by identifier. A row retired here is closed there. A row added here is scheduled there. Conflicts resolve in favor of this register.
Retention
The register itself is a controlled document. Its revision history is its record.
Evidence artifacts retain under their governing documents: screening and exclusion records for at least six years (POL-011), compliance tickets and program files for six to ten years by issue type (POL-003), breach documentation for six years (POL-014), and personnel and acknowledgment records for the duration of employment plus the period their governing policy sets. Where no governing document states a period, completed-cycle evidence is retained for at least six years.